CVE-2026-44012

Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder() fetches an asset by ID and returns its filename and complete folder hierarchy (including volume handle, volume UID, folder names, folder UIDs, and folder URI paths) without checking whether the requesting user has viewAssets or viewPeerAssets permission on the asset’s volume. Any authenticated CP user — even one with zero volume permissions — can enumerate asset filenames and the full folder structure of any volume by supplying arbitrary asset IDs. This vulnerability is fixed in 5.9.18.

CVSS

No CVSS.

References

Link	Resource
https://github.com/craftcms/cms/commit/e3f3eaab3d85badd713cfc2c24e5f0792ecdb586
https://github.com/craftcms/cms/security/advisories/GHSA-33m5-hqp9-97pw

Configurations

No configuration.

History

26 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Craft CMS es un sistema de gestión de contenido (CMS). Desde la versión 5.0.0-RC1 hasta antes de la 5.9.18, AssetsController::actionShowInFolder() obtiene un activo por ID y devuelve su nombre de archivo y la jerarquía completa de carpetas (incluyendo el identificador del volumen, el UID del volumen, los nombres de las carpetas, los UID de las carpetas y las rutas URI de las carpetas) sin verificar si el usuario solicitante tiene permiso de viewAssets o viewPeerAssets en el volumen del activo. Cualquier usuario autenticado del CP - incluso uno con cero permisos de volumen - puede enumerar los nombres de archivo de los activos y la estructura completa de carpetas de cualquier volumen proporcionando IDs de activos arbitrarios. Esta vulnerabilidad se corrige en la versión 5.9.18.

Information

Published : 2026-05-12 21:16

Updated : 2026-10-26 17:10

NVD link : CVE-2026-44012

Mitre link : CVE-2026-44012

CVE.ORG link : CVE-2026-44012

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-44012", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44012", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T14:49:35.768821Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "craftcms", "product": "cms", "versions": [{"status": "affected", "version": ">= 5.0.0-RC1, < 5.9.18"}]}]}], "published": "2026-05-12T21:16:16.003", "references": [{"url": "https://github.com/craftcms/cms/commit/e3f3eaab3d85badd713cfc2c24e5f0792ecdb586", "source": "security-advisories@github.com"}, {"url": "https://github.com/craftcms/cms/security/advisories/GHSA-33m5-hqp9-97pw", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder() fetches an asset by ID and returns its filename and complete folder hierarchy (including volume handle, volume UID, folder names, folder UIDs, and folder URI paths) without checking whether the requesting user has viewAssets or viewPeerAssets permission on the asset\u2019s volume. Any authenticated CP user \u2014 even one with zero volume permissions \u2014 can enumerate asset filenames and the full folder structure of any volume by supplying arbitrary asset IDs. This vulnerability is fixed in 5.9.18."}, {"lang": "es", "value": "Craft CMS es un sistema de gesti\u00f3n de contenido (CMS). Desde la versi\u00f3n 5.0.0-RC1 hasta antes de la 5.9.18, AssetsController::actionShowInFolder() obtiene un activo por ID y devuelve su nombre de archivo y la jerarqu\u00eda completa de carpetas (incluyendo el identificador del volumen, el UID del volumen, los nombres de las carpetas, los UID de las carpetas y las rutas URI de las carpetas) sin verificar si el usuario solicitante tiene permiso de viewAssets o viewPeerAssets en el volumen del activo. Cualquier usuario autenticado del CP - incluso uno con cero permisos de volumen - puede enumerar los nombres de archivo de los activos y la estructura completa de carpetas de cualquier volumen proporcionando IDs de activos arbitrarios. Esta vulnerabilidad se corrige en la versi\u00f3n 5.9.18."}], "lastModified": "2026-10-26T17:10:03.270", "sourceIdentifier": "security-advisories@github.com"}